Update pdfjs-dist - Githubissues

wojtekmaj / react-pdf

Display PDFs in your React app as easily as if they were images.

https://projects.wojtekmaj.pl/react-pdf

MIT License

8.97k stars 861 forks source link

Update pdfjs-dist #1792

Closed VayneValerius closed 1 month ago

VayneValerius commented 1 month ago

Before you start - checklist

[X] I understand that React-PDF does not aim to be a fully-fledged PDF viewer and is only a tool to make one
[X] I have checked if this feature request is not already reported

Description

pdfjs-dist has a high level, arbitrary code injection vulnerability for versions <= 4.1.392. react-pdf is still using a 3.x.x version.

I can see that the isEvalSupported option has been set to false in the 8.0.2 release, which stops the vun from being possible, but for ci pipelines that use a tool like docker scout, it will fail deployments regardless.

Proposed solution

Update pdfjs-dist to 4.2.67

Alternatives

The alternative has already been implemented, which is fine for users who don't give a hoot about security.

Additional information

No response

wojtekmaj commented 1 month ago

Duplicate of #1664